E-Commerce Security: A Rising Threat as Attackers Target Magento Stores
In a concerning development within the realm of e-commerce security, a recent investigation has revealed that attackers have successfully compromised 953 online stores, predominantly running on the Magento platform. This sophisticated attack leverages a JavaScript loader that has undergone notable evolution, enabling it to effectively distinguish between security scanners and genuine shoppers, thereby increasing its efficacy in evading detection.
This nefarious campaign has been operational since July 2025, executing a series of intricate maneuvers and cycling through five different loader domains. The findings come from research conducted by Sansec, a Dutch e-commerce security firm that specializes in identifying and mitigating threats to online retail businesses. The most recent domain, registered on October 6, was detected within the content management system (CMS) blocks of 83 different stores, of which 60 had previously hosted an earlier iteration of the loader.
The JavaScript loader cunningly resides within Magento’s cms_block database table, compelling visitors’ browsers to request instructions from the attackers’ servers. Sansec has reported that this malicious server is capable of accurately distinguishing whether a request originates from a legitimate customer or an automated security scanner. In a worrying twist, it deliberately provides nothing to the scanners, allowing it to remain undetected.
Latest Loader Technology and Security Evasion Techniques
Prior to October, the attack’s operators utilized the Keitaro traffic distribution system to discern how to respond to each visitor. This system provided the capability to either deliver a malicious payload, redirect the browser, or simply refrain from responding altogether. However, following an update on October 7, the loader transitioned to a more sophisticated approach. It began directly calling a newly registered domain and replaying previously saved code in users’ browsers, a tactic that ensured that anyone who received the payload could continue executing it in subsequent page loads, even if the new domain had been taken down or blocked.
An enhancement introduced on October 23 significantly advanced the loader’s capabilities by integrating browser fingerprinting technology. This improved functionality checks for signs of browser automation and scans for hardware details, including screen size, time zone, and language settings, prior to determining how to respond to the incoming request. In a particular test by urlscan.io, when the scanning service loaded one of the infected stores using an automated browser, Sansec reported no injected content was found. This finding emphasizes the effectiveness of the loader’s protective measures, although it also leaves the company yet to ascertain the ultimate goal of this ongoing campaign.
An Ongoing Battle: Patches and Repeat Infections
Sansec further reported on an alarming incident from March, during which the attackers planted the loader on 471 stores within merely an hour, leveraging webshells infiltrated through vulnerabilities like PolyShell (CVE-2026-48356). Among 169 infected Magento 2 installations lacking essential core patches, Sansec found 102 cases that demonstrated evidence of file uploads via the same vulnerabilities.
Ironically, simple patching did not guarantee immunity against reinfection. For instance, a fully patched store operating on Magento version 2.4.7-p10 was found to have picked up the most recent loader just one hour after passing a clean scan. In an earlier inspection, Sansec identified a rogue admin account and a GSocket backdoor within the same store, indicating that vulnerabilities were not merely systemic but also rooted in essential credentials and account management practices.
In light of these intricate challenges, Sansec has urged e-commerce merchants to undertake proactive measures. They recommend that store owners thoroughly search for the malicious loader in their CMS content, review all admin accounts for suspicious activity, and actively hunt for any potential backdoors. Additionally, they advocate for rotating all database, admin, and integration credentials once stores are deemed secure. Moreover, applying the latest security updates provided by Magento and Adobe Commerce is paramount to fortifying defenses against future assaults.
Sansec has issued a critical warning: simply removing the script may render the store temporarily clean, but it does not eliminate the attacker’s write access to the database. Consequently, vulnerable stores risk becoming reinfected if the original entry point remains intact.
As the digital retail landscape continues to evolve, the need for enhanced security measures and vigilance among online merchants has never been more pressing. The alarming rise in sophisticated cyber threats underscores the importance of securing digital storefronts against opportunistic attackers.